Fbi harvester exe Trojan Agent File Malware Analysis: f5d050f714c0f69da07f42ae06394878

Technical Analysis

File Name	fbi_harvester.exe
File Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Scanner Version	1.0.218.174
Database Version	2025-06-20 15:00:29 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	f5d050f714c0f69da07f42ae06394878
SHA1	8fc3b1cf4b4d93419dd611884f5aba02d92569a8
SHA256	d1e3f5e2f01ae8ce1047084a7d665a405abc973235f38ce68bacec70648443d0
SHA512	c8f8ebe8ba24c616b93c5644d58c92aee50c508ad5bb4b0f2d544f3d5af8ad6841dfc4074df4b2002d102bb245d5092ebdac8f679e3b500bd2277475b02b92fe
ImpHash	fc3b0de2e7f988c46ed9c8e46a804071

PE Analysis

Basic Information

▼

Image Base	`0x140000000`
Entry Point	`0x1400010f6`
Compilation Time	2025-06-20 12:56:08
Checksum	0x000356d3 (Actual: 0x0072f6e7)
OS Version	4.0
PEiD Signatures	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	3 libraries KERNEL32, msvcrt, SHELL32
Exports	0 functions
Resources	2 Resources
Sections	12 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	127,656 bytes	128,000 bytes	6.32 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CAD98C7D7D691F5E19995E9E94A5CD15`
`.data`	`0x00021000`	304 bytes	512 bytes	1.34 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C4A257E6A0AC7BD399298DCCF66D26B2`
`.rdata`	`0x00022000`	11,952 bytes	12,288 bytes	5.22 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`83C66CB3D3266A62CC2B364CFA21EE41`
`.eh_fram`	`0x00025000`	4 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.pdata`	`0x00026000`	2,388 bytes	2,560 bytes	4.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E82A046C2D371841B185353E47D3FFBF`
`.xdata`	`0x00027000`	2,856 bytes	3,072 bytes	4.48 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`51E2916E682DD9E84EBA6397904D8DE9`
`.bss`	`0x00028000`	163,024 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00050000`	4,064 bytes	4,096 bytes	4.33 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2CA3A8D0FA1C37927E3D2CDA71E80BF2`
`.CRT`	`0x00051000`	96 bytes	512 bytes	0.29 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B0B9D8E1D47F35A85AB461EDEC7E56CD`
`.tls`	`0x00052000`	16 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00053000`	7,328,748 bytes	7,328,768 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8C2059E1653C11BD127D6038871D60E8`
`.reloc`	`0x00751000`	148 bytes	512 bytes	1.84 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`161D65CC6969AE35A38FF9858B52CC2B`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 2 (7,328,585 bytes)

Resource Type	Count	Total Size	Percentage
RT_RCDATA	1	7,327,320 bytes	100%
RT_MANIFEST	1	1,265 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Fbi_harvester.exe Trojan Agent Analysis